Vulnerability in Patriksimek Vm2
CVE-2026-92951
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-92951?
- CVE-2026-92951 is a critical-severity vulnerability in Patriksimek Vm2, classified under Use of Incorrectly-Resolved Name or Reference. CVSS score: 9.9/10. Published 2026-09-17.
- How severe is CVE-2026-92951?
- Critical severity. CVSS v3 base score is 9.9 out of 10.